This crash only occurred when the RigidBody constraint was used, and the toObject field was set to an armature, as the RigidBody constraint doesn't use subtargets.